ASW #193 - AppSec (& adjacent) Metrics

Application Security Weekly (Audio)

Apr 19, 2022•1 hr 17 min

--:--

Listen in podcast apps:

Listen to this episode in Metacast mobile app

Don't just listen to podcasts. Learn from them with transcripts, summaries, and chapters for every episode. Skim, search, and bookmark insights. Learn more

Episode description

We can create top 10 lists and we can count vulns that we find with scanners and pen tests, but those aren't effective metrics for understanding and improving an appsec program. So, what should we focus on? How do we avoid the trap of focusing on the metrics that are easy to gather and shift to metrics that have clear ways that teams can influence them? In the AppSec News: OAuth tokens compromised, five flaws in a medical robot, lessons from ASN.1 parsing, XSS and bad UX, proactive security & engineering culture at Chime!

Show Notes: https://securityweekly.com/asw193

Segment resources:

- https://www.philvenables.com/post/10-fundamental-but-really-hard-security-metrics

- https://cloud.google.com/blog/products/devops-sre/using-the-four-keys-to-measure-your-devops-performance

Visit https://www.securityweekly.com/asw for all the latest episodes!

Like us on Facebook: https://www.facebook.com/secweekly

For the best experience, listen in Metacast app for iOS or Android

Open in Metacast